Security Configuration Guide for Windows 2000 servers

&http://www.aliyun.com/zixun/aggregation/37954.html ">nbsp; Let's start by introducing the origins of Windows 2000. Windows 2000, formerly known as Windows NT 5. 0, is one of the biggest products of Microsoft's product research and development. It combines many of the best features/performance with Windows 98 and Windows NT 4.0, which is one reason we renamed it. She is a new extension of the Windows family, beyond the original meaning of Windows NT.

Microsoft has a lot of software products, with the continuous expansion and development of the product line, now gradually focus on the implementation of product family brands, such as Windows, Office, BackOffice and Visual Studio series. For enterprise users, Microsoft, on the basis of these product families, integrates the development of digital nervous system (digital nervous system) business philosophy, according to different scenarios, such as knowledge management, business operations and E-commerce to organize product lines to meet the needs of enterprise users to digital management.

The Windows family is one of Microsoft's core product lines, including the 9x series such as Windows 98, the mini series such as Windows CE, and the Windows Nt/windows 2000 Enterprise operating system family. Due to the continuous development of Microsoft and the support of OEM partners, the Windows family products have reached a high market share. The unification of this PC operating system brings the benefits of choice and cost reduction to users and application software developers. Microsoft is positioning itself in the production of "enabling Marvell" companies, production of platform products and development tools for Third-party software developers to provide a large number of value-added opportunities.

How to Install

The choice of version

I strongly recommend that: in the case of language does not become a barrier, please be sure to use the English version. You know, Microsoft's products are known as "Bugs & Patch", the Chinese version of the bug far more than the English version, and the patch is usually late at least half a month (that is, the general Microsoft released a loophole after your server will be half a month in the unprotected state).

Ii. Customization of components

Win2K installs some common components by default, but it is this default installation that is very dangerous, with the security principle "minimal service + minimal permissions = maximum security", only the services that are really needed are installed. The special note here is the "Indexing Service", "FrontPage Server Extensions", and "Internet service Manager", which are some of the most dangerous services.

Iii. managing Application Selection

Choosing a good remote management software is very important, not only the security requirements, but also the application needs. Win2K's Terminal service is a remote control software based on RDP (Remote Desktop Protocol), which is fast, easy to operate and more suitable for routine operation. However, Terminal service also has its shortcomings, because it uses the virtual desktop, coupled with Microsoft programming is not rigorous, when you use the Terminal service to install software or restart the server and so on with the real desktop interactive operation, often will appear in distress phenomenon, For example: Restarting Microsoft's authentication server (COMPAQ, IBM, etc.) using the Terminal Service may be turned off directly. Therefore, for the sake of safety, it is recommended to be equipped with a remote control software as auxiliary, and terminal Service complementary, such as pcanywhere is a good choice.

Allocation of partitions and logical disks

Create at least two partitions, one system partition, one application partition. This is because Microsoft's IIS (Internet ihformation Server) often has vulnerabilities, and if you put the system and IIS on the same drive, it can cause system files to leak and even allow intruders to remotely gain administrative power.

It is recommended to establish three logical drives, the first to install system and important log files, the second to put IIS, and the third to put FTP, so that no matter whether IIS or FTP out of security vulnerabilities will not directly affect the system directory and system files.

V. Installation sequence Selection

Do not feel as long as can install the system, even if finished, in fact, Win2K installation sequence is very important.

First, pay attention to the time to access the network. Win2K has a flaw in the installation, that is, after entering the administrator password, the system will establish a "$ADMIN" share, but did not use the password just entered to protect it, this situation will continue until the computer started again. During this time, anyone can enter the system through the "$ADMIN", and as soon as the installation completes, the various services will automatically run, and the server at this time is full of vulnerabilities, very easy to invade from the outside. Therefore, you must not connect the host to the network until the Win2K server is fully installed and configured.

Second, pay attention to the installation of patches. Patches should be installed after all applications have been installed, because patches often replace or modify some system files, which may not work if the patch is installed first.